diff options
author | Nathan Kinder <nkinder@redhat.com> | 2015-03-10 20:02:07 -0700 |
---|---|---|
committer | Patrick Uiterwijk <puiterwijk@redhat.com> | 2015-03-11 14:48:55 +0100 |
commit | a1bcbfd426a6c3860edf53e12da32ff6daad4442 (patch) | |
tree | 23ec7aaa0a6c168792cb78d8ca8d1767b203f5e8 | |
parent | f06950e46262e4899f42ba3b197525bb2b88b9cb (diff) | |
download | ipsilon-a1bcbfd426a6c3860edf53e12da32ff6daad4442.tar.gz ipsilon-a1bcbfd426a6c3860edf53e12da32ff6daad4442.tar.xz ipsilon-a1bcbfd426a6c3860edf53e12da32ff6daad4442.zip |
Validate SP path settings during installation
There are a number of URL path options that can be specified as
options when running ipsilon-client-install. There are certain
rules that must be followed to result in a valid mod_auth_mellon
configuration:
- All path options must be prefixed with '/'.
- The mellon endpoint path (--saml-sp) must be a subpath of the
httpd 'Location' element is it contained within (--saml-base).
- The logout (--saml-sp-logout) and post (--saml-sp-post) paths
must be subpaths of the mellon endpoint (--saml-sp).
This adds validation for all of the above rules.
https://fedorahosted.org/ipsilon/ticket/82
Signed-off-by: Nathan Kinder <nkinder@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
-rwxr-xr-x | ipsilon/install/ipsilon-client-install | 21 |
1 files changed, 21 insertions, 0 deletions
diff --git a/ipsilon/install/ipsilon-client-install b/ipsilon/install/ipsilon-client-install index 237b439..f7d9883 100755 --- a/ipsilon/install/ipsilon-client-install +++ b/ipsilon/install/ipsilon-client-install @@ -270,6 +270,27 @@ def parse_args(): if len(args['hostname'].split('.')) < 2: raise ValueError('Hostname: %s is not a FQDN.') + # Validate that all path options begin with '/' + path_args = ['saml_base', 'saml_auth', 'saml_sp', 'saml_sp_logout', + 'saml_sp_post'] + for path_arg in path_args: + if not args[path_arg].startswith('/'): + raise ValueError('--%s must begin with a / character.' % + path_arg.replace('_', '-')) + + # The saml_sp setting must be a subpath of saml_base since it is + # used as the MellonEndpointPath. + if not args['saml_sp'].startswith(args['saml_base']): + raise ValueError('--saml-sp must be a subpath of --saml-base.') + + # The saml_sp_logout and saml_sp_post settings must be subpaths + # of saml_sp (the mellon endpoint). + path_args = ['saml_sp_logout', 'saml_sp_post'] + for path_arg in path_args: + if not args[path_arg].startswith(args['saml_sp']): + raise ValueError('--%s must be a subpath of --saml-sp' % + path_arg.replace('_', '-')) + # At least one on this list needs to be specified or we do nothing sp_list = ['saml'] present = False |